Description
The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if (string_length > buflen), which accepts a string whose length is exactly buflen. After memcpy() fills the whole buffer, buf[string_length] = '\0' then writes one byte past the end of the buffer (CWE-787).

The string value and its length are taken directly from the incoming CoAP payload during a LwM2M WRITE: do_write_op_json() parses the payload obtained from coap_packet_get_payload(), and get_string() is invoked from lwm2m_write_handler() (engine_get_string() in subsys/net/lib/lwm2m/lwm2m_message_handling.c) for a LWM2M_RES_TYPE_STRING resource. The destination buf/buflen is either the resource instance's fixed data buffer (res_inst->data_ptr/max_data_len) or the engine validation buffer (msg->ctx->validate_buf). A LwM2M server (the client's DTLS peer) can therefore write a string resource with a value whose length equals the target buffer size and force a one-byte overflow.

The overflow is a single out-of-bounds write of the constant byte 0x00 immediately past the resource or validation buffer, corrupting the adjacent byte in memory. It is not an information leak and the written value is fixed, so it is not a direct code-execution primitive, but it can corrupt adjacent state (an adjacent resource value, a length/flag field, or a struct field) and cause data corruption or a crash. Triggering the write is deterministic; the resulting impact depends on memory layout.

The fix changes the guard to string_length >= buflen, rejecting the exact-length case and aligning the JSON formatter with the other content formatters (lwm2m_rw_plain_text.c, lwm2m_rw_oma_tlv.c, lwm2m_rw_senml_json.c, lwm2m_rw_cbor.c, lwm2m_rw_senml_cbor.c), which already used the correct boundary check.
Published: 2026-08-31
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the Zephyr LwM2M JSON content formatter allows a write operation to copy a JSON string into a caller-supplied buffer and then NUL‑terminate it one byte past the buffer end. The guard accepts an input length equal to the buffer size, leading to an off‑by‑one out‑of‑bounds write of the constant byte 0x00. This does not give direct code execution but can corrupt adjacent memory, potentially corrupting resource values or internal state and causing a crash. The weakness is classified as CWE-193 (Off‑by‑One Error) and CWE-787 (Out‑of‑Bounds Write).

Affected Systems

The flaw resides in the Zephyr RTOS LwM2M implementation. All versions of Zephyr that include the vulnerable lwm2m_rw_json.c file before the fix are affected; no specific version range is listed, so any instance that exposes the LwM2M JSON content formatter to external writes is potentially vulnerable.

Risk and Exploitability

The CVSS score is 5.4, indicating a moderate impact. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the overflow by sending a LwM2M WRITE request with a string resource whose content length exactly matches the buffer size, and the LwM2M server (the client’s DTLS peer) can supply such a payload. The attack requires network access to the device’s CoAP interface and the ability to write to a string resource, making it a remote attack against devices with exposed LwM2M services. While the immediate effect is data corruption or denial of service, the deterministic nature of the trigger allows an attacker to reliably produce the effect once the conditions are met.

Generated by OpenCVE AI on August 31, 2026 at 20:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr firmware update that patches the guard in lwm2m_rw_json.c to reject exact‑length strings
  • If an update cannot be applied immediately, limit or revoke WRITE permissions for LwM2M string resources on the affected device to prevent the vulnerable operation
  • Implement monitoring of CoAP traffic and system logs to detect anomalous write operations or crashes that may indicate exploitation

Generated by OpenCVE AI on August 31, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 31 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if (string_length > buflen), which accepts a string whose length is exactly buflen. After memcpy() fills the whole buffer, buf[string_length] = '\0' then writes one byte past the end of the buffer (CWE-787). The string value and its length are taken directly from the incoming CoAP payload during a LwM2M WRITE: do_write_op_json() parses the payload obtained from coap_packet_get_payload(), and get_string() is invoked from lwm2m_write_handler() (engine_get_string() in subsys/net/lib/lwm2m/lwm2m_message_handling.c) for a LWM2M_RES_TYPE_STRING resource. The destination buf/buflen is either the resource instance's fixed data buffer (res_inst->data_ptr/max_data_len) or the engine validation buffer (msg->ctx->validate_buf). A LwM2M server (the client's DTLS peer) can therefore write a string resource with a value whose length equals the target buffer size and force a one-byte overflow. The overflow is a single out-of-bounds write of the constant byte 0x00 immediately past the resource or validation buffer, corrupting the adjacent byte in memory. It is not an information leak and the written value is fixed, so it is not a direct code-execution primitive, but it can corrupt adjacent state (an adjacent resource value, a length/flag field, or a struct field) and cause data corruption or a crash. Triggering the write is deterministic; the resulting impact depends on memory layout. The fix changes the guard to string_length >= buflen, rejecting the exact-length case and aligning the JSON formatter with the other content formatters (lwm2m_rw_plain_text.c, lwm2m_rw_oma_tlv.c, lwm2m_rw_senml_json.c, lwm2m_rw_cbor.c, lwm2m_rw_senml_cbor.c), which already used the correct boundary check.
Title Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
Weaknesses CWE-193
CWE-787
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-31T18:45:07.165Z

Reserved: 2026-07-01T19:30:21.245Z

Link: CVE-2026-14368

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-31T19:16:45.887

Modified: 2026-08-31T20:13:25.457

Link: CVE-2026-14368

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T20:30:05Z

Weaknesses